Assume we’re on an x86-64 machine and that we have read-access to the state of a program at a given instant, but we don’t have debugging symbols; in particular, we can read the program’s address space and the registers.
Is it possible to reliably determine the depth of the call stack? Under which assumptions (e.g., calling conventions)?
By the depth of the call stack I mean the number of call instructions minus the number of ret instructions that have happened in total in the course of the execution of the program. In the following pseudo trace, the number in the bracket is the depth of the call stack after the instruction in the respective line:
add eax ebx  ... call 0x1234  call 0x2345  call 0x3456  add eax ebx  jmp 0x4567  ... ret  ... ret  call 0x1234  ... ret  ret 
I’m not yet an expert in x86, calling convention and the stack layout. However, I vaguely suppose that one can “walk” the stack with the help of the